Effective Date: 11 October 2026
1. Data Controller Identity and Contact Information
Young Souls Event ("Young Souls", "we", "us", or "our") operates social events in Bangkok, Thailand, and acts as the Data Controller responsible for the personal data collected pursuant to this Privacy Policy.
- Controller: Young Souls Event
- Operating location: Khwaeng Sala Thammasop, Khet Thawi Watthana, Bangkok 10170, Thailand
- Data Protection Contact: youngsouls.event@gmail.com or via direct message to our official Instagram account (@youngsouls.event).
- Data Protection Officer: We have not appointed a formal Data Protection Officer pursuant to Section 41 of the Personal Data Protection Act B.E. 2562 (2019) ("PDPA"), as our processing activities do not meet the statutory criteria requiring a mandatory appointment.
2. Scope and Regulatory Framework
This Privacy Policy outlines the categories of personal data we collect when you access our ticketing page, initiate or complete a booking, process a payment, attend our events, or communicate with us; the operational purposes and legal bases for such processing; the third-party recipients of your data; retention periods; security measures; and your statutory rights under the PDPA. This policy is made accessible to you at the point of data collection in accordance with PDPA requirements and is linked from our ticketing interface.
3. Categories of Personal Data Collected
3.1 Data Provided Directly by the Data Subject
| Data Category | Specific Data Elements | Purpose of Processing |
|---|---|---|
| Booking Details | First name, last name, and email address of the purchaser; first and last names of additional guests in group bookings; ticket type and quantity; promotional/discount codes; Instagram handle (optional). | To create, process, and administer ticket reservations; issue and deliver digital QR tickets; and communicate critical booking information. |
| Payment Verification | Images of bank transfer slips (which may display account holder name, issuing bank, account details, and transaction reference numbers); transaction amounts; automated/manual verification status. | To verify payment authenticity, maintain financial proof of purchase, and resolve billing disputes. |
| Communication Responses | Interactions recorded from automated reminders (e.g., selection of options such as "I'm still deciding", "I can't pay with PromptPay", "I can't make it anymore", or "I already have a ticket"). | To suppress unnecessary follow-up communications and evaluate non-completion causes. |
| Account Adjustments | Modifications requested or executed regarding pending order names or email addresses. | To maintain record accuracy and integrity. |
| Direct Inquiries | Contents of electronic mail or Instagram messages sent to us, alongside your sender handle/address. | To address inquiries, facilitate customer service, execute approved name changes, and evaluate refund eligibility. |
| Third-Party Guest Data | Names of additional guests submitted during group bookings. | To issue individual admission tickets. You warrant that you possess lawful authority to disclose such third-party data to us and that you have informed such individuals of this Privacy Policy. |
3.2 Data Collected Automatically via the Ticketing Interface
Upon accessing or submitting data through our ticketing interface, your browser and device automatically transmit specific technical parameters, which are associated with your booking record:
| Parameter Category | Specific Technical Elements | Purpose of Processing |
|---|---|---|
| Hardware & OS Parameters | Device class, operating system, browser engine (e.g., mobile, iOS, Safari, or embedded Instagram browser). | To optimize web rendering across hardware environments and diagnose technical faults. |
| User Agent Identifiers | Complete User-Agent identification string, including browser version and hardware model. | System fault diagnosis and prevention of automated/fraudulent bookings. |
| Display Geometry | Screen dimensions, viewport size, and device pixel density (e.g., 390x664, 3x). | Dynamic interface formatting for mobile and desktop screens. |
| Localization | Preferred system language and local time zone setting (e.g., en-GB, Asia/Bangkok). | Regional audience analytics and localized content display. |
| Network Connectivity | Connection technology classification (e.g., Wi-Fi or Cellular), where transmitted by the client browser. | Performance optimization for low-bandwidth connections. |
| Traffic Referral | HTTP referrer header string (e.g., instagram.com, or specific landing URLs). | Attribution analysis regarding traffic and marketing sources. |
| Campaign Tracking | UTM parameters (utm_source, utm_medium, utm_campaign) stored via client-side storage for up to 30 days. | Evaluation of promotional campaign efficacy and attribution of delayed bookings. |
| Geographic Estimation | Approximate location derived at the city, regional, and national level (e.g., Bangkok, Thailand). | Audience demographic analysis. |
Location Processing Mechanism: Client IP addresses are processed transiently via an external geolocation service to determine city, regional, and national coordinates. We retain only the resulting geographical designations; raw IP addresses are not stored within our primary application database. Server hosting infrastructure logs IP addresses strictly for security and operational integrity. Rate-limiting mechanisms monitor request counts per IP address for a maximum duration of 24 hours prior to automated deletion.
3.3 Analytics Regarding Email Communications
We maintain records of outbound email service transmissions (including digital tickets and automated payment reminders) and delivery confirmation statuses. For uncompleted bookings, up to two automated reminder emails may be dispatched. We record dispatch timestamps and email link interaction events (initial access, most recent access, and total access frequency) to prevent redundant communications. Unsubscribe selections are recorded and kept until you ask us to erase them, so that we respect your preference.
3.4 Data Collected On-Site During Events
When attending an event, we record the check-in timestamp upon scanning your digital ticket QR code. For door sales, we record transaction amounts, chosen payment methods, handling team member identifiers, and images of transfer slips (for bank transfers). We do not scan, copy, or retain physical identity documents; if we ask to see government-issued photo identification (for example to confirm age), it is inspected visually and returned immediately.
3.5 Promotional Photography and Videography
Events are recorded via photography and videography for marketing and promotional publication. Attendees may appear in background or crowd capture. Refer to Section 11 regarding your statutory right to object.
3.6 Excluded Data Categories
We do not process credit or debit card primary account numbers (PANs) directly (card processing, where available, is handled entirely via PCI-DSS compliant third-party payment gateways). We do not collect national identity card numbers, passport numbers, or sensitive personal data under Section 26 of the PDPA (such as health records, religious beliefs, biometric data, or criminal history records).
4. Purposes and Lawful Bases for Processing
We process personal data strictly pursuant to the legal bases established under Section 24 of the PDPA:
| Purpose of Processing | Statutory Lawful Basis (PDPA Section 24) |
|---|---|
| Creation and administration of bookings, payment verification, digital ticket issuance, event check-in validation, and customer support. | Performance of Contract (s. 24(3)): Necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract. |
| Maintenance of financial, accounting, and tax records, and compliance with lawful governmental orders. | Legal Obligation (s. 24(6)): Necessary for compliance with a legal obligation to which the controller is subject. |
| Dispatching uncompleted booking reminders, preventing fraudulent transactions, securing infrastructure, and evaluating marketing performance. | Legitimate Interests (s. 24(5)): Necessary for legitimate interests pursued by the controller, balanced against the fundamental rights of the data subject. You maintain the right to object (Section 11). |
| Capturing event photography and videography for marketing purposes. | Legitimate Interests (s. 24(5)): Necessary for the legitimate interest of promotional marketing, subject to the data subject's right to object. |
We do not currently rely on consent as a primary legal basis for core processing operations. If processing requiring explicit consent is introduced (such as third-party advertising tracking), formal consent will be requested prior to processing, and may be revoked at any time. We do not execute automated decision-making producing legal or significant effects, nor do we construct behavioral advertising profiles.
5. Disclosure and Categories of Data Recipients
We do not sell personal data. Personal data is disclosed strictly to the following categories of recipients:
5.1 Internal Personnel
Authorized team members access booking and operational records via administrative tools protected by individual credentials, strong password hashing, and one-time email codes at sign-in.
5.2 Third-Party Data Processors
External service providers process personal data on our behalf, strictly under written data processing agreements, as Section 40 of the PDPA requires:
| Provider | Service Description | Data Categories Disclosed | Processing / Storage Location |
|---|---|---|---|
| Supabase, Inc. | Database management & backend hosting infrastructure | Complete booking records, transaction data, and payment slip media | Singapore |
| Cloudflare, Inc. | Content delivery network & security web application firewall | In-transit application traffic and network request logs | Global edge network |
| Framer B.V. | Public website hosting and built-in website analytics | General website visit information (approximate location, device type, browser type) | Global network, hosted on Amazon Web Services |
| Resend, Inc. | Transactional email delivery service | Recipient names, email addresses, and message body contents | United States |
| Thunder Solution (Slip Verification) | Payment slip verification (reads the slip and checks it with the bank) | Payment slip images, transaction references, and monetary amounts | Thailand |
| IP geolocation services (ipinfo.io and ipapi.co) | Automated IP-to-location resolution, over encrypted connections | Transient IP addresses | Outside Thailand (United States) |
If we offer card payments in the future, they will be processed by a licensed payment provider, which will receive the data needed to process the payment. We will update this Privacy Policy before doing so.
5.3 Financial Institutions
Banks and payment networks involved in executing transactions process data independently pursuant to their respective regulatory obligations.
5.4 Statutory Authorities
Data is disclosed to governmental bodies, tax authorities, or law enforcement entities strictly where mandated by applicable legislation or lawful regulatory orders.
5.5 AI Operational Tools
Internal analytical tools utilized to evaluate aggregate event metrics receive strictly anonymized transaction codes; guest names, email addresses, handles, ticket numbers, and contact details are excluded entirely.
6. International Data Transfers
Certain data processors enumerated in Section 5 store or process data on servers located outside the Kingdom of Thailand. All cross-border transfers are executed in compliance with Sections 28 and 29 of the PDPA, relying on necessary contract performance exceptions or contractual data protection safeguards ensuring appropriate security standards.
7. Data Retention Periods
Personal data is retained only for the duration necessary to fulfill the purposes specified herein, subject to the following statutory and operational schedules:
| Data Category | Retention Schedule |
|---|---|
| Guest profiles, booking records, device metadata, approximate location data, and reminder histories | Retained for 24 months following event conclusion, after which records are permanently anonymized. |
| Payment slip images and transactional electronic mail communications | Retained for 24 months from creation date, after which media files are deleted. |
| Financial transaction figures and payment records (de-identified) | Retained for 5 years pursuant to Thai statutory legal and tax recordkeeping mandates. |
| Client-side campaign tracking tags (UTM) | Retained on client browser storage for 30 days. |
| Security rate-limiting IP logs | Retained for a maximum of 24 hours. |
| Verified Erasure Requests | Erased or anonymized promptly upon approval, excluding records subject to mandatory legal preservation. |
| System Backups | A daily copy of our data is kept for 14 days and then deleted automatically. Data erased at your request may remain in these copies until they expire. |
8. Data Security Standards
We implement technical and organizational security measures appropriate to the risk of processing, including one-time email codes at sign-in for administrative access, role-based access restrictions, encrypted data transmission (TLS/HTTPS), encrypted database storage, short-lived signed URLs for payment slip access, automated rate-limiting protections, audit logging of sensitive actions (such as exporting or erasing personal data and changing access codes), and isolated personnel accounts.
In the event of a personal data breach likely to result in a risk to the rights and freedoms of data subjects, we will notify the Office of the Personal Data Protection Committee (PDPC) within 72 hours of becoming aware of the breach where feasible, and notify affected data subjects directly where the breach poses a high risk.
9. Electronic Mail Communications
Transactional emails regarding ticket issuance and booking details constitute service communications. Automated payment reminders are dispatched exclusively for initiated, uncompleted bookings (limited to a maximum of two dispatches between 09:00 and 21:00 Bangkok time) and incorporate an immediate unsubscribe mechanism. Marketing communications are not transmitted without prior express consent.
10. Cookies, Local Storage, and Website Analytics
Our ticket checkout interface does not deploy advertising cookies or tracking pixels. Local browser storage is utilized strictly for necessary functionality: storing UTM campaign parameters (30 days) and maintaining uncompleted booking state across browser app-switching during bank transfers.
Our public website uses Framer's built-in analytics, which records basic visit information such as approximate location, device type and browser type to produce traffic statistics. The website does not use advertising pixels or advertising cookies.
11. Statutory Data Subject Rights
Under Sections 30 through 36 of the PDPA, you possess the following statutory rights regarding your personal data:
- Right of Access (s. 30): Request access to and obtain a copy of your personal data processed by us.
- Right to Data Portability (s. 31): Request transmission of your personal data in a structured, commonly used, machine-readable format to another data controller where technically feasible.
- Right to Object (s. 32): Object to the collection, use, or disclosure of your personal data, including processing based on legitimate interests or direct marketing.
- Right to Erasure / Anonymization (s. 33): Request the destruction, erasure, or permanent anonymization of your personal data where statutory conditions are met.
- Right to Restriction of Processing (s. 34): Request the restriction of data processing under statutory conditions.
- Right to Rectification (s. 35): Request that your personal data be maintained accurate, up-to-date, complete, and not misleading.
- Right to Withdraw Consent: Revoke previously granted consent at any time without affecting the lawfulness of processing based on consent prior to withdrawal.
To exercise any statutory right, contact us via email at youngsouls.event@gmail.com or via direct message on Instagram (@youngsouls.event). Identity verification may be required prior to executing requests. Statutory rights requests are processed free of charge within 30 days of receipt. Requests may be refused strictly pursuant to legal exceptions established under the PDPA, with formal reasons recorded. Regarding event photography and media, notify event staff on-site or contact us post-event to request exclusion or removal from published materials where reasonably achievable.
12. Supervisory Authority Complaints
You maintain the statutory right to submit a complaint to the Office of the Personal Data Protection Committee (PDPC) if you consider that our processing of your personal data violates the PDPA.
13. Minors and Age Capacity
Our events are strictly restricted to individuals aged 20 years and older pursuant to Thai legal age limits. We do not knowingly collect personal data from individuals under 20 years of age. If you become aware that a minor has submitted personal data to us, contact us immediately for prompt data erasure.
14. Third-Party Platforms and External Hyperlinks
Our web interfaces and social media posts contain links to third-party services (including Instagram and Meta Platforms). This Privacy Policy does not apply to third-party platforms, which operate under independent privacy notices.
15. Policy Amendments
We reserve the right to amend this Privacy Policy to reflect operational, technical, or statutory changes. Revised versions will be published on our website alongside an updated effective date.
16. Operational Contact Details
Young Souls Event
Operating location: Khwaeng Sala Thammasop, Khet Thawi Watthana, Bangkok 10170, Thailand
Electronic Mail: youngsouls.event@gmail.com
Instagram: @youngsouls.event